The 2.7 Problem: Why Ransomware Victims Typically Face More Than One Weakness

The Most Underrated Number in the 2025 Sophos Report

When Sophos published its State of Ransomware 2025 report in June 2025, the headline findings were encouraging. Data was encrypted in 50% of attacks, down from 70% in 2024. 53% of victims were fully recovered within a week, up from 35%. The median ransom payment halved, from $2 million to $1 million. Those numbers are real, and they matter. But the report also explored something for the first time: the organizational factors that left companies exposed. One statistic from that section, in our view, reframes how enterprise risk leaders should think about ransomware.

The survey covered 3,400 IT and cybersecurity leaders in 17 countries, all at organizations with 100 to 5,000 employees that had been hit by ransomware in the previous 12 months. Asked why their organization fell victim, respondents cited 2.7 contributing factors on average.

Not one. Not even two. On average, victims named close to three operational conditions behind a single attack.

This is not a footnote. It is strong evidence that single-control ransomware defense does not match how victims describe their own incidents, and that backup architecture has quietly become one of the most important compensating controls in the enterprise stack.

At BackupSec, we believe the 2.7 figure is the most strategically useful number in the report. This article unpacks what it measures, why it makes prevention-only strategies hard to defend, and what it implies for organizations still treating backup as an afterthought to "real" security.

What the 2.7 Actually Represents

The question Sophos asked was "Why do you think your organization fell victim to the ransomware attack?" Respondents could pick more than one of seven operational reasons, and on average they picked 2.7. The full list, with the share of the 3,400 respondents who named each:

• Lack of expertise: 40.2%. Not having the skills or knowledge to detect and stop the attack in time.
• Unknown security gap: 40.1%. A weakness in defenses the organization was not aware of.
• Lack of people/capacity: 39.4%. Not enough cybersecurity experts monitoring systems at the time of the attack.
• Lack of protection: 39.0%. Not having the necessary cybersecurity products and services.
• Known security gap that had not been addressed: 38.2%.
• Poor-quality protection that could not stop the attack: 37.1%.
• Human error: 34.2%.

Two things follow from how the question was asked. The 2.7 is an average, so some victims named one factor and others named several. And it records what respondents believe contributed, not the output of a forensic investigation. The factors also overlap. Sophos groups them into protection issues (63% of respondents), resourcing issues (63%) and security gaps (65%), and finds "no single stand-out source."

Sophos asked about the technical entry point separately. Exploited vulnerabilities were the root cause in 32% of attacks, compromised credentials in 23%, malicious email in 19% and phishing in 18%. Those shares describe how the attacker got in. The 2.7 describes the conditions around it.

Sophos's own summary is that "victims are typically facing multiple operational challenges." We read that as a structural problem, not a run of bad luck.

If victims typically name nearly three contributing conditions, then the defense model most enterprises still operate against, "find the gap, close the gap," faces an attacker who only needs one of them to be exploitable. Meanwhile, the defender has to manage all of them at once.

That is not a security problem. That is an asymmetry problem.

The Asymmetry: One Door Versus Seven

Consider the math from the attacker's perspective.

A modern ransomware operator (a state-aligned group, a RaaS affiliate or an independent crew) does not need to identify and exploit every weakness in your environment. They need a single viable path: one unpatched system, one set of compromised credentials, one misconfigured cloud bucket, one phishing-susceptible user, one administrative gap.

Now consider the math from the defender's perspective. You are responsible for:

1. Vulnerability management across thousands of assets, in cycles that no patching cadence reliably keeps ahead of.
2. Identity governance across human users, service accounts, federated identities, and increasingly autonomous agents.
3. Email and collaboration security, a major entry point and the one with the most human variability. In the Sophos survey, malicious email and phishing together were the root cause of 37% of attacks.
4. Endpoint protection against payloads that evolve faster than signature-based detection can adapt.
5. Network segmentation designed against threat models that change continuously.
6. Cloud and SaaS configuration across dozens or hundreds of services, each with its own permission model.
7. Backup and recovery infrastructure that must work under conditions that the rest of your stack has already failed to prevent.

The attacker plays one cell on this board. The defender plays all seven, every day, with finite resources.

These seven domains are our framing, not Sophos's seven answer options. Sophos's list describes organizational conditions such as expertise, capacity and unknown gaps, and those cut across every domain above. The 2.7 figure still supports the asymmetry with data. Victims described their attacks (the survey asked about the previous 12 months, so many of them happened in 2024) as the product of nearly three contributing conditions on average. That is not a sign of negligence. It is a sign that complete prevention is structurally hard to achieve.

Why "Just Fix the Root Cause" Is Bad Math

A common response to incident analysis is to identify the "root cause" and remediate it. Most post-incident reviews reinforce this thinking. The 2025 Sophos data shows why this framing, while intuitively satisfying, misses how victims themselves describe what went wrong.

If victims name 2.7 contributing factors on average, then a review that stops at a single root cause is likely to be incomplete. It tells you which door the attacker walked through. It does not tell you why the building had so many unlocked doors that one of them was always going to be available.

This matters operationally. Resources spent on the specific entry vector of last year's incident are resources not spent on the architectural gaps that will determine next year's. Our reading of the Sophos data is that organizations working in single-root-cause mode are likely under-investing in the layered controls that determine whether any entry vector leads to a catastrophic outcome.

The strategic reframing is this: in any sufficiently complex enterprise environment, attackers will eventually find a viable path. The question that determines whether that path leads to a paid ransom is not "did we close every door?" but "does our architecture survive once one of them opens?"

The Compensating Control Most Enterprises Underestimate

Here is the architectural insight the 2.7 figure points to: when prevention fails with some regularity, the layers that determine business outcomes shift downstream.

This is where backup architecture moves from "infrastructure hygiene" to "primary strategic control."

In a single-vector threat model, backup is a fallback. In a multi-factor threat model, backup is the compensating control for the prevention failures that will occur. Sophos's first State of Ransomware in Enterprise 2025 report, built on the 1,733 respondents from organizations with 1,000 to 5,000 employees, shows the stakes:

• 48% of enterprise victims whose data was encrypted paid the ransom to get it back, down from 55% in 2024.
• Enterprise use of backups to restore encrypted data fell to a four-year low of 53%, down from 73% in 2024.
• Organizations with 1,000–5,000 employees spent $1.83 million on average to recover, excluding any ransom paid, according to the main 2025 report.

Sophos reads the payment and backup figures together as pointing "to stronger resistance to demands together with weaknesses and lack of backup resilience." It also notes that 30% of enterprises with encrypted data used other means to restore it, so the drop in backup use is not only a story of backups failing. Still, the picture is coherent. Fewer attacks reach encryption, but when they do, backups carried the recovery in only about half of enterprise cases. The gap between prevention maturity and recovery maturity is exactly where ransom payments live.

For enterprise risk leaders, this implies a specific reallocation of architectural attention. Investments in detection, identity, and patching all remain essential. But none of them eliminate the 2.7. They merely shift which three doors are open on a given day. The control that determines whether an opened door becomes an existential incident is the one most organizations have under-modernized: the architecture that holds clean, immutable, validated copies of business-critical data and can restore them under adversarial conditions.

What 2.7 Can Look Like in an Incident

Sophos does not break the 2.7 into a sequence, so what follows is our illustration of how contributing factors can compose in an enterprise environment, not survey data:

Factor one is usually an entry vector: an unpatched edge device, a compromised credential reused across systems, or a successful phishing email. This is the failure that the post-incident report will call the "root cause."

Factor two is typically a privilege or visibility failure that allowed the initial foothold to expand: excessive standing permissions, gaps in lateral movement detection, or inadequate segmentation between business units.

Factor three is the one we focus on: a recovery-layer failure that turns a contained breach into a paid ransom. Backup credentials reachable from production, retention policies modifiable by compromised admins, or restore procedures that have never been tested against the scenario the team now faces. Sophos has one narrow data point here: in the main 2025 report, of the 151 organizations that paid more than the initial ransom demand, 38% said their backups failed or were malfunctioning.

The first two factors get the attention in incident response. The third often decides the financial outcome, and it is hard to evaluate honestly until an incident forces the question.

This is the operational reality the 2.7 figure points at. The factors are not abstract: together they are the sequence of failures that turns a manageable security event into a board-level crisis.

What This Means for Risk Allocation

If you accept the 2.7 finding as architecturally meaningful (and a survey of 3,400 victim organizations makes it hard to dismiss), several allocation conclusions follow.

Diversify investment across the failure chain, not within a single layer. Doubling down on email security while leaving recovery architecture unchanged shifts which factor fails first; it does not reduce the total number of failures. Enterprise security budgets that allocate disproportionately to prevention while treating backup as a commodity line item are operating against a threat model that does not reflect how victims describe their incidents.

Evaluate architectures against multi-factor scenarios, not single-vector tests. A test that confirms one defense holds is not evidence that your environment survives a real attack. In the Sophos survey, victims named nearly three contributing factors on average. Tabletop exercises and red-team engagements should be designed to test that compound condition explicitly.

Measure recovery confidence, not backup completion. Sophos does not say why enterprise backup use fell to 53%, and part of the drop reflects other recovery methods. Our reading is that many backup architectures were designed for single-factor failures (a server died, a user deleted a file) and are now asked to perform under multi-factor conditions (the attacker has been in the network for two weeks and has touched everything). Those are different problems. Sophos's own recommendation is to "make quality backups and regularly practice restoring data from them."

Treat the recovery layer as the compensating control it has become. When prevention will sometimes fail, the layer that determines outcomes is the one that holds clean, isolated, immutable copies of data and can restore them at speed under hostile conditions. That layer must be architected, governed, and tested with the same rigor as the production environment it protects.

Where BackupSec Comes In

At BackupSec, our approach is built around one premise: prevention will eventually fail somewhere, and when it does, the recovery layer decides whether the failure is recoverable or existential.

Three of our services map to the questions the 2.7 figure raises:

• ZeroMON answers "What is our backup environment actually doing right now?" It monitors Veeam Backup & Replication: job health, configuration changes with who, what and when (Forensic & Audit), a Security Analyzer checklist, reports, and a honeypot on the monitoring appliance. It shows immutability status as Veeam's own repository settings report it; it reads Veeam's configuration and does not verify object-level locks on storage. Alerts go out by email and in-app notification. ZeroMON deploys on-premises as an OVA, connects with a read-only account, and sends nothing to BackupSec or any third party.
• ZeroTAM answers "Do we have the expertise to interpret what we are seeing?" That is the question behind the most common factor in the Sophos list. A dedicated backup-security advisor covers architecture, ransomware recovery planning and capacity, with priority support during a crisis. It is advisory, not software.
• ZeroPEN answers "How far would an attacker get against our backups?" It is a threat-led penetration test of Veeam Backup & Replication, Veeam ONE and Enterprise Manager that simulates a ransomware kill chain in eight stages mapped to MITRE ATT&CK, from initial access through backup neutralization to proof of encryption capability. It is non-destructive: it "never deletes real backups, performs real encryption, or stops production or backup services." Findings come with audit-ready evidence, and critical findings are retested.

We do not replace your backup platform. We help make the recovery layer it supports observable, understood and tested against the multi-factor conditions the Sophos data describes.

If your organization is reading the Sophos 2025 report and concluding that the answer is to close every door, the data is telling you something else: the doors will not all stay closed, and the architecture that determines what happens when one of them opens is the conversation worth having in 2026.

Talk to BackupSec →

This analysis draws on Sophos's State of Ransomware 2025 and State of Ransomware in Enterprise 2025 reports. The interpretation and framework are BackupSec's own. To discuss how this analysis applies to your environment, get in touch with our team →